# DMARC record

A DMARC record tells receiving mail servers what to do when a message claiming to be from your domain fails authentication, and where to send reports about it. It's what actually stops other people sending email with your domain in the From address. It's a TXT record at _dmarc.yourdomain that starts with v=DMARC1.

- Record type: TXT (DMARC is carried in TXT records)
- Lives at: _dmarc
- Used for: Email
- How common: Everyday
- Defined in: RFC 7489

## Format

```
_dmarc <ttl> IN TXT "v=DMARC1; p=<policy>; rua=mailto:<address>"
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| v=DMARC1 | Marks the record. Must come first. | `DMARC1`, upper case. |
| p= | The policy for mail that fails. | `none` (report only), `quarantine` (spam folder), `reject` (refuse). |
| rua= | Where to send daily aggregate reports. | `mailto:` addresses, comma-separated. |
| sp= | A different policy for subdomains. | `none`, `quarantine`, `reject`. Defaults to p. |
| adkim=, aspf= | Alignment: whether the DKIM or SPF domain must match the From domain exactly (s) or may be a subdomain (r). | `r` (default) or `s`. |
| pct= | Apply the policy to only this share of failing mail. | 0 to 100, default 100. Being replaced by t= in the updated specification. |
| ruf=, fo= | Per-message failure reports, and when to send them. Few providers send these. | `mailto:` addresses; fo `0`, `1`, `d`, `s`. |

## Examples

### Start here: monitor

```
_dmarc 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
```

Nothing changes for your mail. Reports show every server sending as your domain, so you can fix SPF and DKIM first.

### Then quarantine

```
_dmarc 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
```

Once reports show your real mail passing, failing mail goes to spam.

### Full protection

```
_dmarc 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
```

Mail that fails is refused. Required for BIMI logos.

### A domain that never sends

```
_dmarc 3600 IN TXT "v=DMARC1; p=reject;"
```

With v=spf1 -all, nobody can send as this domain.

## How DMARC decides

A message passes DMARC if it passes [SPF](https://lemon.domains/dns-records/spf) or [DKIM](https://lemon.domains/dns-records/dkim), and the domain that passed matches (aligns with) the domain in the From address people see. SPF checks the hidden envelope sender and DKIM checks the d= in the signature; DMARC is the step that connects either of them to the visible From.

Most mail fails DMARC not because it's fake but because a service sends without your DKIM key or from its own envelope domain. That's why you start with p=none and read the reports.

## Reports at another domain

If rua points to an address at a different domain (such as a DMARC reporting service), that domain must publish a TXT record allowing it: example.com._report._dmarc.reportingservice.com with v=DMARC1. Reporting services set this up for you.

## Since 2024, a must for bulk senders

Gmail and Yahoo require a DMARC record (at least p=none) from anyone sending more than 5,000 messages a day to their users, along with SPF and DKIM. A DMARC record is a good idea for every domain anyway.

## TTL

3600. Use 300 while you're moving from none to quarantine to reject.

## Common mistakes

- Publishing at @ instead of _dmarc. Receivers only look at _dmarc.example.com.
- Going straight to p=reject without reading reports, and blocking your own invoices or newsletters.
- Writing the rua address without mailto:.
- Sending reports to another domain without that domain's authorisation record.
- Two DMARC records at _dmarc. Receivers ignore both.
- Lower-case dmarc1 in the version tag.

## At your DNS host

- Name: _dmarc (most dashboards add the domain). Type: TXT.
- Route 53: wrap the value in double quotes.

## Questions

### What DMARC policy should I use?

Start with p=none and a rua address to collect reports. When the reports show your real senders passing, move to p=quarantine, then p=reject.

### Do I need SPF and DKIM for DMARC?

You need at least one of them passing and aligned with your From domain; set up both so mail still passes when one breaks, such as SPF failing on forwarded mail.

### Where do I put the DMARC record?

At _dmarc.yourdomain.com, as a TXT record. Subdomains without their own record use the parent's policy (or its sp= policy).

### What do DMARC reports contain?

Daily XML summaries from receivers such as Google and Microsoft: which IP addresses sent mail as your domain, how many messages, and whether SPF and DKIM passed. They don't contain message content.

## Related

- [SPF record](https://lemon.domains/dns-records/spf.md)
- [DKIM record](https://lemon.domains/dns-records/dkim.md)
- [BIMI record](https://lemon.domains/dns-records/bimi.md)
- [TXT record](https://lemon.domains/dns-records/txt.md)
- [MX record](https://lemon.domains/dns-records/mx.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/dmarc